214c22cc13004c4e5c7b6ef898d2c354acc6a27eb5125d8ff783c5e0b6508e06

Resubmissions

25/03/2025, 12:07

250325-panv1ayrt810

08/02/2025, 12:09

250208-pbptpavper10

08/02/2025, 11:46

250208-nxtjbsspgt10

06/02/2025, 02:27

250206-cxm6rszlfs10

Analysis

max time kernel
12s
max time network
18s
platform
windows7_x64
resource
win7-20250207-en
resource tags

arch:x64arch:x86image:win7-20250207-enlocale:en-usos:windows7-x64system
submitted
25/03/2025, 12:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
altas installer.exe
Size 87.5MB
Sample250325-panv1ayrt8
SHA256 214c22cc13004c4e5c7b6ef898d2c354acc6a27eb5125d8ff783c5e0b6508e06
MD5 e1c8bc131cc1502e31dec5146351c557
SHA1 95792a7ed9bec9bccf88b3ecdffe1a06fb72b8ef
SHA512 b5807f60f1c5d6fde557c7c27b5424e57eefe7c8c1a962f3949f3a412603f94dfb26eb18e30bd5e1ebbf705a9ef6ccd7d51fe4a74d9d525d1382257b19f4eac0
SSDEEP 1572864:z2GKlEWCsm/OkiqOv8im2AUdfmE7qliwiYgj+h58sMwhue9DOVwJq:znKe3sm/OknOv8i3XfCwy51ueV6
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1960	altas installer.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00030000000209a4-1264.dat	upx
behavioral1/memory/1960-1266-0x000007FEF6270000-0x000007FEF6862000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 236 wrote to memory of 1960	236	altas installer.exe	30
PID 236 wrote to memory of 1960	236	altas installer.exe	30
PID 236 wrote to memory of 1960	236	altas installer.exe	30

C:\Users\Admin\AppData\Local\Temp\altas installer.exe
"C:\Users\Admin\AppData\Local\Temp\altas installer.exe" bcdedit /set shutdown /r /f /t 2
1⤵
- Suspicious use of WriteProcessMemory
PID:236
- C:\Users\Admin\AppData\Local\Temp\altas installer.exe
  "C:\Users\Admin\AppData\Local\Temp\altas installer.exe" bcdedit /set shutdown /r /f /t 2
  2⤵
  - Loads dropped DLL
  PID:1960

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

python311.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI2362\python311.dll
Size 1.6MB
SHA256 6c65da37cf6464507ad9d187a34f5b5d61544b83d831547642d17c01852599a1
MD5 548809b87186356c7ac6421562015915
SHA1 8fa683eed7f916302c2eb1a548c12118bea414fa
SHA512 c0b63bf9908e23457cf6c2551219c7951bc1a164f3a585cde750b244fa628753ee43fde35f2aa76223fd9f90cf5ea582241ab510f7373a247eae0b26817198fc
SSDEEP 49152:LurykeLOskGnvqFtCxkwGrZ84z4Kzov9ra:yrmLFpvqFtwkwGr74TM
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1960-1266-0x000007FEF6270000-0x000007FEF6862000-memory.dmp

Download